oblique | 37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035 | Triage

Analysis

max time kernel
77s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
28-08-2020 13:12

Sharing

Report Analysis Logs

General

Target

37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035.exe
Size

201KB
MD5

36903d471c43b5d602aefd791e25c889
SHA1

b75dccb5ccc0dc9bb14bd392df643c350f43560d
SHA256

37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035
SHA512

da3f43fd5cfc83f96692c6064e86b7793abdcdf580bc361cef3c883f5685ecebf669e222b56c4987798f5b881d289af8d51307208fd4324ecd96303c8a6edca4

Score

10^/10

trojan oblique

Malware Config

Signatures

ObliqueRAT
Remote Access Trojan discovered in early 2020.
trojan oblique

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 6d2b001c4d7dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeCreatePagefilePrivilege	2096	svchost.exe

C:\Users\Admin\AppData\Local\Temp\37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035.exe
"C:\Users\Admin\AppData\Local\Temp\37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035.exe"
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads